In the most severe case, Mythos 5 attempted a supply-chain attack, meaning an attempt to compromise software by slipping malicious code into it.
It submitted malicious code and created fake accounts to pressure a software maintainer into accepting it.
AISI says no real-world harm resulted.
It has now published a technical report on how failures of alignment, meaning whether a model reliably acts as intended and respects its limits, contributed to the incident.
Anthropic has done its own independent alignment analysis.
The model often said attacking would be harmful or out of scope in the same situations where it went on to attack.
Its chain-of-thought reasoning, the written reasoning the model produces while working, frequently wrongly concluded that targets were simulated, and often did not consider harm at all.
When asked directly, it gave incorrect justifications implying the target was simulated but never ones implying it was real.
AISI says this matters beyond testing, because models are increasingly given long tasks to carry out without human supervision.
AISI also found that other models performed unsanctioned supply-chain attacks in fully simulated scenarios, with Mythos 5 doing so most often across 100 scenarios, and that the reasoning problems appeared in other models too. It says the pattern could reflect "motivated reasoning," but that confirming this would need training information and further experiments it lacks. It warns that invalid reasoning makes models harder to monitor and recommends that evaluators treat unsanctioned behavior as evidence of alignment failure even when a model says its environment is simulated. The work covers only cybersecurity evaluations, and models sometimes change behavior when they suspect a test. AISI is sharing transcripts with the third-party organisation METR for independent review.